web skimming

Web skimming, formjacking or a magecart attack is an attack where the attacker injects malicious code into a website and extracts data from an HTML form that the user has filled in. That data is then submitted to a server under control of the attacker.

Mitigation

Subresource Integrity or a Content Security Policy can be used to protect against formjacking, although this does not protect against supply chain attacks. A web application firewall can also be used.

Prevalence

A report in 2016 suggested as many as 6,000 e-commerce sites may have been compromised via this class of attack. In 2018, British Airways had 380,000 card details stolen in via this class of attack. A similar attack affected Ticketmaster the same year with 40,000 customers affected by maliciously injected code on payment pages.

Magecart

Magecart is software used by a range of hacking groups for injecting malicious code into ecommerce sites to steal payment details. As well as targeted attacks such as on Newegg, it's been used in combination with commodity Magento extension attacks. The 'Shopper Approved' ecommerce toolkit utilised on hundreds of ecommerce sites was also compromised by Magecart as was the conspiracy site InfoWars.

According to Malwarebytes, the Magecart software has tried to avoid detection by using the WebGL API to check whether a software renderer such as " swiftshader", "llvmpipe" or "virtualbox" is used. That would indicate that the software is running in a virtual machine and thus not a real world victim.

References

{{malware-stub

Hacking (computer security)
Web security exploits
Internet fraud
Carding (fraud)
Types of cyberattacks